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We consider the security of continuous-variable quantum key distribution using thermal (or noisy) Gaussian 
resource states. Specifically, we analyze this against collective Gaussian attacks using direct and reverse rec- 
onciliation where both protocols use either homodyne or heterodyne detection. We show that in the case of 
direct reconciliation with heterodyne detection, an improved robustness to channel noise is achieved when large 
amounts of preparation noise is added, as compared to the case when no preparation noise is added. We also 
consider the theoretical limit of infinite preparation noise and show a secure key can still be achieved in this 
limit provided the channel noise is less than the preparation noise. Finally, we consider the security of quantum 
key distribution at various electromagnetic wavelengths and derive an upper bound related to an entanglement- 
breaking eavesdropping attack and discuss the feasibility of microwave quantum key distribution. 



PACS numbers: 03.67.Dd, 03.67.Hk, 42.5().-p 

I. INTRODUCTION 

Continuous-variable quantum key distribution (QKD) 111,01 
is the ability to generate a secret key between two distant par- 
ties, Alice and Bob, which can be used to encrypt messages 
for secure communication. This is achieved by using Gaus- 
sian quantum resource states [2J where its theoretical security 
is guaranteed by the no-cloning theorem. A typical Gaussian 
modulated protocol fs'-'?] involves Alice randomly displacing 
a number of pure vacuum modes and sending them over an 
insecure quantum channel to Bob. These modes are then mea- 
sured by Bob using either homodyne f?] or heterodyne detec- 
tion ilt]. The various stages of classical communication |1] 
follow next, including error correction, where either direct yt] 
or reverse reconciliation |4] can be used. 

Generally, in Gaussian QKD protocols, it is assumed that 
Alice starts off with a large number of pure vacuum states. 
However, this is an idealization and is never quite true in 
practice with small amounts of unknown Gaussian prepara- 
tion noise often being present. The idea of analyzing the secu- 
rity of continuous-variable QKD using such noisy or thermal 
states was first considered in ll9[ [Tol] . Here they showed using 
reverse reconciliation that the distance over which continuous- 
variable QKD was secure declined rapidly as the resource 
states became noisier, ultimately resulting in the inability to 
generate a secure key. However, in a subsequent work lUlll . 
it was shown using direct reconciliation that the distance with 
which the protocol is secure does not decline to zero as the 
states become noisier In fact, even though the rate of gen- 
eration of the secret key decreases for increasing noise, it re- 
mains bigger than zero for values of transmission T > 0.5. 
This means that the security threshold of the protocol remains 
at T = 0.5 for extremely high values of preparation noise. 
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Thus, up to a requirement of a strong modulation of the input, 
thermal state QKD is able to reach distances comparable to 
standard QKD. Furthermore, an application of the analysis of 
noisy coherent states was found by considering the security of 
QKD at various wavelengths of the electromagnetic spectrum, 
revealing regions of security from the optical all the way down 
into the microwave region 1 11]. 

In this paper, we build upon the work presented in ifTlll 
and outline our results here. We begin by using the previ- 
ous analysis of reverse ifTol [Till and direct reconciliation ifTTll 
using homodyne detection and extending them both to study 
the case of heterodyne detection. For the case of direct recon- 
ciliation and heterodyne detection we show an improved ro- 
bustness to channel noise when large amounts of preparation 
noise is added, as compared to the case with zero prepara- 
tion noise. This effect of noise improving the performance 
of QKD using direct reconciliation, was previously seen in 
the context of homodyne detection where pure coherent states 
were more robust than pure squeezed states |12]. In 1 11] it 
was shown that direct reconciliation could tolerate a thermal 
variance of lO"' times that of the pure vacuum mode and still 
show no deterioration in the security threshold of the protocol 
(albeit with a reduced key rate). Here we extend this result and 
show that, provided the channel noise is less than the prepa- 
ration noise, the same protocol can, in principle, tolerate any 
amount of preparation noise, again at a cost of decreasing key 
rate. Finally, we consider the security of QKD at various elec- 
tromagnetic wavelengths and develop an improved security 
bound along with an upper bound related to an entanglement- 
breaking eavesdropping attack. 

This paper is organized as follows. Section II introduces 
the main concepts of thermal state QKD. In Sees. Ill and IV 
the secret key rates for direct and reverse reconciliation using 
both homodyne and heterodyne detection are given. Section 
V considers QKD in the so-called classical limit where an in- 
finite amount of preparation noise is added for direct recon- 
ciliation using homodyne detection. Finally, before conclud- 
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ing in Sec. VIII, we look at the security of QKD at various 
wavelengths along with the feasibility of microwave QKD in 
Sec. VII. 



II. THERMAL STATE QUANTUM KEY DISTRIBUTION 

The initial stages of a thermal state QKD protocol consists 
in Ahce preparing a number of randomly displaced thermal 
states and then sending them to Bob over an insecure quan- 
tum channel monitored by Eve (cf., Fig.[T]i. This initial mode 
prepared by Alice can be described in the Heisenberg picture 
as 



Xa — Xs + Xq, 



(1) 



where Xs describes the classical signal encoding and Xq 
describes the quantum noise of the thermal mode. Here 
the quadrature variables are given by: Xa G {Qa, Pa}, 
Xs G {Qa,Pa} and Xq G {Qo,Po}- The overall variance 
V := V{Xa) of Alice's initially prepared modes is given by 



V = Vs + Vo, 



(2) 



where Vs is a Gaussian distribution with zero mean. Here Vq 
is the shot-noise which can be defined in terms of the condi- 
tional variance as 

V{Qa\Qa) = VipAlPA) ^Vo>l, (3) 
where the conditional variance is defined as |jl3l[l4ll 



V{X\Y) = V{X) 



\{XY)\^' 
V{Y) 



(4) 



We can decompose the shot-noise variance as Vo ~ 1 + f3 
where /3 is the variance of the preparation noise at Alice's sta- 
tion and 1 denotes the variance of the pure vacuum mode. It is 
common in most continuous-variable QKD protocols to theo- 
retically let V — Vs + 1, i.e., zero preparation noise (f3 — 0) 
in Alice's mode preparation. However in our analysis we con- 
sider the general case where /3 is different from zero. This 
means that the shot-noise Vq (that we also call the "purity") 
can be greater than 1. Then we make the valid assumption 
that this preparation noise is restricted to Alice's station and 
not accessible, or known, to Eve (or even to Alice for that 
matter). 

The most important type of eavesdropping attack is the col- 
lective Gaussian attack | IsUlTt]. It was shown that such an at- 
tack is the most powerful attack allowed by quantum physics, 
up to a suitable symmetrization of the protocols |18]. It con- 
sists in Eve interacting her independent ancilla modes with 
Alice's mode for each run of the protocol in such a way to 
generate a memoryless (or one-mode) Gaussian channel. The 
entangling doner JT^ is the most important and practical ex- 
ample of a collective Gaussian attack and is used in our anal- 
ysis. This consists in Eve perfectly replacing the quantum 
channel between Alice and Bob with her own quantum chan- 
nel where the loss is simulated by a beam splitter with trans- 
mission T e [0, 1]. 



She then prepares ancilla modes E and E" in an Einstein- 
Podolsky-Rosen (EPR) entangled Gaussian state 1,20,1 with 
variance W (see Fig. [T]i. Eve keeps one mode E" and in- 
jects the other mode E into the unused port of the beam split- 
ter, leading to the output mode E'. This operation is repeated 
identically and independently for each signal mode sent by 
Alice. Eve's output modes are then stored in a quantum 
computer and detected collectively at the end of the proto- 
col. Eve's final measurement is optimized based on Alice and 
Bob's classical communication. Note that this attack can be 
simply described by two parameters: the channel transmis- 
sion T and the channel noise W. The latter parameter can be 
replaced by the equivalent noise of the channel 



(1-T) 



(5) 



where the first term (1 — T)/T corresponds to the noise in- 
duced by the loss and e is the excess channel noise which can 
be written as e = [W — 1)(1 — T)/T. In the particular case 
where W — 1, or equivalently e = (no excess noise), the 
attack corresponds to a pure loss channel. 



Alice 



V = Vs+ y. 



Wj >-E- 

E 



Bob 



Q or P (Horn) 
Q and P (Het) 



FIG. 1: Schematic of a continuous- variable QKD protocol using 
thermal states. The loss in the quantum channel is modeled by a 
beam splitter with channel transmission T. The eavesdropping attack 
is a Gaussian collective attack in the form of an entangling doner at- 
tack where the variance of the EPR state is W with the modes of the 
EPR beam described by the operators E" and E' . The initial mode 
sent by Alice Xa is a thermal state and once Bob receives the mode 
he will perform either a homodyne (Hom) or heterodyne (Het) 
measurement on it. 



III. REVERSE RECONCILIATION 

We begin the analysis by considering reverse reconcilia- 
tion I'T] (denoted by the symbol •^) using homodyne and het- 
erodyne detection. Note that reverse reconciliation using ho- 
modyne detection has been analyzed before [T^ . For com- 
pleteness, we give the derivation for reverse reconciliation for 
homodyne detection so as to help in the derivation for hetero- 
dyne detection. Before commencing we make a brief com- 
ment about notation. When we consider homodyne detection 
the relevant variable Xb is, Qb G M (or Pb G R, equiva- 
lently). On the other hand, when considering heterodyne de- 
tection, the relevant variable Xb is the pair {Qb, Pb} G R^- 
Also a variable with hat is an operator while the same vari- 
able without a hat is the corresponding classical variable after 
measurement. 
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A. Homodyne Detection 

The secret key rate Jl-*l^°™] for reverse reconciliation 
where Bob uses homodyne detection is given by 



(6) 



where the mutual information between Alice and Bob is given 
by 



liXA : Xb) := H{Xb) - H{Xb\Xa), (7) 



where 



H{XB)^-\og^V{XB), (8) 
is the Shannon (or classical) entropy and 

H{XB\XA) = \l0g^V{XB\XA), (9) 

is the conditional Shannon entropy [21]. The mutual informa 
tion between Eve and Bob is given by the Holevo bound (|2~ 
defined as 



I{Xb : E) := S{E) - S{E\Xb), 



(10) 



where S{ ) is the von Neumann (or quantum) entropy. The 
von Neumann entropy of a Gaussian state p containing n 
modes can be written in terms of its symplectic eigenval- 
ues iH 



(11) 



fc=i 



where 



= (- 



logs 



2 r^^\ 2 



(12) 



We will show how to explicitly calculate the symplectic spec- 
trum u = {i^i, Vn} soon. 

To begin with though, let's calculate Alice and Bob's mu- 
tual information. To achieve this the first step is to consider 
the output modes at Bob's (and Eve's) station. These are given 
respectively by 

V{Qb) = V{Pb) = {1-T)W + TV ■.= bv, (13) 
V{Qe') = V{Pe') = (1 - T)V + TW ey, (14) 

with the following conditional variances 



V{Qb\Qa) = ViPB\PA) = {l-T)W + TVo := h, 



(15) 



ViQE'lQA) = V{Pe'\Pa) = (1 - T)Vo + TW ei, 



(16) 



derived using the definition given in Eq. (|4|l. Using Eq. (|7]) 
with Eqs. ST3[ and ( fTSl l we can calculate Alice and Bob's mu- 
tual information to be 



I{XA:XB) = llog^ 



(1 - T)W + TVs + TVo 



{1-T)W + TVq 



(17) 



Note that, ultimately in the above equation it is Vq that will 
be varied in our calculations. Next up is the calculation of 
Eve and Bob's mutual information, i.e., Eq. ( fTOl ). First though 
we need to introduce the covariance matrix. The covariance 
matrix V can be constructed using the following definitions of 
its matrix elements 



Vim ■■= ^{YiYm + Y,nYi) - {Yi){Ym), (18) 
Vu - (l^') - (Yi)^ V{Yi), (19) 



where Yi is the element of the quadrature row vector 
Y — (Qi, A, Qn, ^ri) which describes the bosonic system 
of n modes. As mentioned previously, to calculate Eq. ( fTOl i, 
we need to calculate the symplectic spectrum of the appro- 
priate covariance matrices. The symplectic spectrum v = 
{vi, ...jVn} of an arbitrary covariance matrix V can be cal- 
culated by finding the (standard) eigenvalues of the matrix 
liOVj, where defines the symplectic form and is given by 



k=l ^ 



(20) 



Here is the direct sum indicating adding matrices on the 
block diagonal. 

Eve's covariance matrix is made up from the two modes E' 
and E" 

^e{v,v)-[^ wi)^ ^^^^ 

where ip = [T{W^ — 1)]^^^ and the notation "diag" simply 
means a matrix with the arguments on the diagonal elements 
of a matrix and zeros everywhere else. Here Z and I are the 
Pauli matrices 



1 

-1 



I 



1 
1 



(22) 



To calculate Eve's symplectic spectrum we note that a partic- 
ular covariance matrix of the form 



where c > and T e [0,1], has a symplectic spectrum with a 
simple expression given by 



^± i [Vy ± (a - b)] 



(24) 



where y = {a + b)^ - Ac^T > 4 Therefore, using the 
above. Eve's symplectic spectrum can be expressed in a more 
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compact form as 

^ 2 



^/{ev + W)^ -4T{W^ - 1) ± (ey - M^) 



(25) 



Next we need to calculate the symplectic spectrum of the co- 
variance matrix V^;!^^- This represents the covariance ma- 
trix of a system where one of the modes has been measured 
using homodyne detection (in this case Bob) and is given 

by laiMiasi] 



where 



n 



1 




(26) 



(27) 



Here D is a 4 x 2 matrix describing the (quantum) correlations 
between Eve's modes {E' , E"} and Bob's output mode Xb- 
It is given by 



D 



{E'Xb)1 
{E"Xb)Z 



(hZ 



where 



e = VT{1 - T){Vs + Vo- W), 
(j) = \/T^^/W^ - 1, 



(28) 



(29) 
(30) 



a nd we have used Xb = \/TXa + Vl - TE and E' ^ 
VT^Xa - VTE. Using Eq. we find that Eve's con- 
ditional covariance matrix is given by 



E\Xe 



A C 
B 



(31) 



where 
A = 

B = 

C = 







vw 

T(V-W)+W 

(i-r)y 

l-T+TWV n 
TV+W-TW " 
W 



TW 



V 

TV+W-TW 



The symplectic spectrum of the above conditional covariance 
matrix is composed by the two eigenvalues i26ll 



v± = 



'A± VA2 -4dctV 



(32) 



where dot V (the determinant of the covariance matrix) and 
A := dot A + dot B + 2 dot C are global symplectic invari- 
ants. Note that these quantities can also be simply expressed 
in terms of the symplectic spectrum as 



detV = 



A = 



(33) 



Using Eq. ( |32] ) the corresponding symplectic spectrum i'eiXb 
of YeiXb '-^'1 calculated but is not written down explicitly 
here due to its length. Finally using Eq. (fTTT i and Eq. (fT2l) 
with the just computed symplectic spectra, we can determine 
Bob and Eve's mutual information. The final secret key rate 
j:^-4[Hom] calculated and plotted in Fig.|2](a) using various 
values of Vq for a lossy channel (i.e., a quantum channel with 
only loss and no added noise, i.e., W — 1). We find that, 
for only moderate values of Vq, the security of the protocol 
reduces rapidly. 




0.4 0.6 
Transmission T 

FIG. 2: Secret key rates for reverse reconciliation using (a) homo- 
dyne detection and (b) heterodyne detection for various values of Vo. 
Top dashed (red) line is a pure encoded state sent by Alice with the 
solid (blue) lines giving different values of impurity, i.e., Vo = 2,3,5 
from top to bottom. Here Vg = 10^ and W = 1 (i.e., only loss on 
the quantum channel). 



B. Heterodyne Detection 

The secret key rate for reverse reconciliation where Bob 
now employs heterodyne detection is given by 



^<[Het] :=i(^Xa:Xb)-I{Xb:E), 



(34) 



where, as mentioned previously, Xb is {Qb, Pb} G for 
heterodyne detection and not Qb € M (or equivalently Pb E 
M) as it was previously for homodyne detection. The mutual 
information between Alice and Bob is again defined as 

liXA : Xb) := H{Xb) - H{Xb\Xa), (35) 
except now the Shannon entropies are 

HiXB) = log^V{XB), (36) 

and 

H{Xb\Xa) = log2 V{Xb\Xa). (37) 
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Note that the above two formulas do not have the usual factor 
of 1 /2 out the front. This indicates that twice the amount of in- 
formation is obtained using heterodyne detection, but at a cost 
of the extra unit of vacuum noise introduced at the beam split- 
ter The mutual information between Eve and Bob is again 
given by the Holevo information 



I{Xb:E) ■.= S{E)-S{E\Qb,Pb), 



(38) 



but now S{E\Qb,Pb) is calculated from the symplectic 
spectrum i^e\Qb,Pb °f conditional covariance matrix 
'^e\Qb,Pb- The variances of the quadratures of the output 
modes after Bob's heterodyne measurement are given by 

V{Qb) - V{Pb) = ^ibv + 1) := b'y, (39) 

where by is defined in Eq. (fT3b . The following conditional 
variances now apply 

V{QB\QA)^V{PB\PA)^^{bl + l). (40) 

Using Eq. ( l35T l we calculate Alice and Bob's mutual informa- 
tion to be 



l0g2 



{1-T)W + TVs + TVo + l 



{l~T)W + TVa + l 



(41) 



The covariance matrix of Eve conditioned on Bob's hetero- 
dyne measurement results {Qb, Pb} is given by ^ 



^e\qb,pb = - e-'D{nYBn'^ + i)d^ 



(42) 



where Ye is given by Eq. ( 1211 1 and Yb — byl- Here 6 
detVs + TrVs + 1 and D is defined previously in Eq 



We find that 9 
We find that 



2bv + 1 and nYB^ + I = Vs + I. 



al VTcZ 
TcZ bl 



(43) 



where 



{l-T)V + {T + V)W 
l + TV +{1-T)W ' 
1-T+{1 + TV)W 
l + TV + (l - T)W' 
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1 + V 



1 + TV+{1-T)W 



The above covariance matrix has the corresponding symplec- 
tic spectrum 



E\Qb,Pb 



1 



= -[^±{a^b)] 



(44) 



where y = [a + b)'^ — Ac^T as given by Eq. (|24] |. Using 
this, the final secret key rate i?"*!^"^*! can be calculated and is 
plotted in Fig.|2](b) for different values of Vq. 




0.2 0.4 0.6 

Transmission T 



FIG. 3: (a) Comparison of reverse reconciliation using homodyne 
detection (dashed lines) against heterodyne detection (solid lines) for 
Vb = 1 (red lines) and Vb = 1.5 (blue lines) and with only loss on 
the quantum channel, i.e., W = 1 with Vs = 10"^. (b) Close up 
view of (a) where Vb = 1.5 for heterodyne detection (solid (blue) 
line) crosses over with the pure state (dotted (red) line) for homodyne 
detection. 



We can now compare homodyne detection to heterodyne 
detection using reverse reconciliation with, for example, an 
impurity of Vq = 1.5. This is plotted in Fig. [3] (a). We note 
that after a certain value of line transmission (« T > 0.79) 
it is better, in terms of information rates, to use heterodyne 
detection with a noisy input state than homodyne detection 
with a pure input state, c.f., Fig.[3](b). 



IV. DIRECT RECONCILIATION 

We now look at direct reconciliation (►) where Bob 
uses both homodyne and heterodyne detection. First though, 
we begin with our analysis using homodyne detection as first 
presented in ifTlll . 



A. Homodyne Detection 

The secret key rate for direct reconciliation using homo- 
dyne detection is given by 



i?' 



IiXA:XB)~I{XA:E), 



(45) 



where I{Xa : Xb) has already been calculated in Eq. ( fTTb 
(note the mutual information between Alice and Bob is sym- 
metric with respect to the two reconciUation protocols). For 
Eve we have 



liXA : E) := S{E) - S{E\Xa), 



(46) 



where S{E\Xa) is calculated from the spectrum i^e\Xa of 
the conditional covariance matrix V^ix^- Eve's conditional 
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covariance matrix for homodyne detection using direct recon- 
ciliation is equal to 



' E\Qa 



(47) 



where Vb is defined in Eq. (1211 1. The resulting symplectic 
spectrum calculated using Eq. ( [32] i is again too complicated to 
be written down here. However, in Fig.|4](a) we have plotted 
the resulting secret key rates for various values of Vq. Here 
we see the surprising feature of direct reconciliation as first 
noticed in 1 1 1 ] where adding preparation noise onto the initial 
states does not reduce the transmission range of the protocol 
(despite the fact that the secret key rate is reduced). 




0.7 0.8 
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FIG. 4: Secret key rates for direct reconciliation using (a) homodyne 
detection and (b) heterodyne detection. Here the dashed (red) line 
is the pure mode case Vo = 1 where the solid (blue) lines are for 
impurity values Vb = 2, 3, 5, from top to bottom; again using the 
parameters: W — 1 and Vs — 10''. (c) Close up view of (b) show- 
ing that as Alice's input state becomes more and more thermal, even 
though the information rates are reduced, the protocol becomes more 
secure in terms of where the lines cross the transmission axis. The 
values of Vq are indicated next to the respective lines. 



B. Heterodyne Detection 

In our final analysis of this section, we consider heterodyne 
detection using direct reconciliation. The secret key rate for 
direct reconciliation using homodyne detection is given by 



(48) 



where I{Xa ■ Xb) is the same as Eq. dTTT i. For Eve, her 
mutual information with Alice is defined as 



I{Xa : E) S{E) - SiE\QA, Pa), 



(49) 



where S{E\Qa,Pa) is calculated from the spectrum 
i^ElQi.PA of '^he conditional covariance matrix 
This conditional covariance matrix is given by 



'E\Qa.Pa- 



yE\QA,PA=^E{Vo,Vo), 

where again is defined in Eq. ( |2T] ). Using Eq. 
write the symplectic spectrum as 



(50) 



we can 



^E\Qa,Pa 



v/(ei + W)2 - 4r(H/2 _ 1) ± (e^ _ w) 

(51) 



The resulting secret key rates are plotted in Fig. |4](b) for dif- 
ferent values of initial mode impurity. As with homodyne 
detection, when the impurity is increased, there is no reduc- 
tion in the security threshold of the protocol, only the secret 
key rates. However, the security threshold for heterodyne de- 
tection (T « 0.73) is higher than that of homodyne detec- 
tion (T — 0.5). Surprisingly though, by adding more and 
more uncertainty to the initial modes, the security threshold 
improves slightly for heterodyne detection; meaning that the 
protocol can, at least for a small window of transmissions, tol- 
erate slightly higher levels of loss (cf., Fig.|4](c)). For exam- 
ple, for a pure vacuum as input a secure key can be generated 
from a transmission of T >« 0.73. However, when the initial 
mode is set to Vb = 5 we have T >« 0.68. Numerically, 
we find that for large values of impurity Vq ^ 1, the security 
asymptotes to T — > 0.67. Out of the four family of protocols 
studied here, this is the only protocol that exhibits such behav- 
ior. Figure |5] contains plots of the security thresholds (where 
R = 0) for both homodyne and heterodyne detection using 
direct reconciliation and shows the improvement in security 
when (unknown) preparation noise is added, with heterodyne 
detection offering the largest improvement. This situation of 
noise improving the performance of QKD has previously been 
seen in the context of direct reconciliation where (pure) co- 
herent states and homodyne detection are more robust than 
squeezed states and homodyne detection ||T2| 1. Furthermore, 
reverse reconciliation, where Bob measures squeezed states 
using heterodyne detection rather than homodyne detection, 
also shows an enhanced robustness I27il28ll . Achieving such 
security robustness only works when additional noise is added 
to the reference point (either Alice or Bob) of the reconcilia- 
tion protocol. This means Alice in direct reconciliation and 
Bob in reverse reconciliation. 
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Channel Transmission T 



FIG. 5: Security threshold plots for direct reconciliation where the 
(red) dashed lines indicate a pure vacuum mode at Alice's prepara- 
tion side and the (blue) solid lines indicate a noisy coherent state 
(Vo S> 1) as input. The two lines converging to T = 0.5 are for 
homodyne detection while the other two lines indicate heterodyne 
detection. Adding preparation noise to the heterodyne detection pro- 
tocol illustrates the largest improvement in security of the pair of two 
protocols. 



As we did with the reverse reconciliation protocols, we 
compare homodyne detection to heterodyne detection but this 
time for direct reconciliation. This comparison is plotted in 
Fig. |6] (a) where we have compared the two pure vacuum 
modes against Vb = 3 for both homodyne and heterodyne 
detection. We have also plotted a comparison between direct 
and reverse reconciliation for both homodyne and heterodyne 
detection using impurity values of Vq = 3 and 5. In the case of 
homodyne detection, as given in Fig.|6](b), we find that direct 
reconciliation offers stronger security and higher information 
rates than reverse reconciliation for the same values of impu- 
rity. This is somewhat mirrored in the heterodyne detection 
scenario given in Fig. |6] (c), although it only becomes more 
apparent for values of impurity higher than Vq — 5. 



C. Effect of Channel Noise 

Here we consider the effect of channel noise (W > 1) on 
the protocol that uses direct reconciliation with homodyne de- 
tection for larger values of preparation noise. In particular 
we consider preparation noises with a variance up to 10^. In 
Fig.|7]we plot the two cases of channel noises of = 1.01 
and W — 3 (Fig. [T] (a) and (b), respectively). As expected 
both plots show a reduction in both the channel transmission 
and secret key rate for both channel noises. However, the char- 
acteristic where the various values of Vq converge to the same 
channel transmission value still remains. 



(a) 




Transmission T 

FIG. 6: (a) Comparison of secret key rates between direct reconcilia- 
tion using homodyne detection (dashed lines) and heterodyne detec- 
tion (solid lines) for Vb = 1 (red lines) and Vb = 3 (blue lines) and 
with only loss on the quantum channel, i.e., W = 1, with Vs = 10^. 
Comparison of direct and reverse reconciliation for (b) homodyne 
detection and (c) heterodyne detection for a lossy channel. Here 
the dashed (red) lines indicate direct reconciliation whilst the solid 
(blue) lines indicate reverse reconciliation. In each of the cases we 
have plotted the impurity values of Vb = 3 and 5. 



V. QKD IN THE CLASSICAL LIMIT 

So far we have considered what happens to the 
four protocols (direct/reverse reconciliation using homo- 
dyne/heterodyne detection) when modest amounts (at most 
Vb = 5) of preparation noise is added onto Alice's in- 
put states. In this section we consider the 'classical limit', 
where an infinite amount of preparation noise is added, i.e., 
Vq — > oo, and hence, the quantum vacuum mode contribu- 
tion to QKD becomes (almost) negligible. Here we consider 
the case of direct reconciliation (using homodyne detection) 
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FIG. 7: The effect of channel noise W on the secret key rates for 
direct reconciliation using homodyne detection for a quantum chan- 
nel with noise of (a) W — 1.01 and (h) W — 3 for various values 
of Vo where Vs = lO'l The effect of increasing the channel noise 
only shifts the security threshold of both plots while maintaining the 
same characteristic of the lossy channel fllll where all values of Vo 
converge to the same channel transmission. Such a preparation noise 
effect is not seen in reverse reconciliation. 



because as we have seen, reverse reconciliation (using either 
homodyne and heterodyne detection) does not handle prepara- 
tion noise very well as the security (channel transmission) and 
the secret key rate deteriorate quickly for modest increases in 
noise. It was first shown in |11] that for a pure loss channel 
(W = 1), a secret key could still be established even if Alice's 
preparation noise was as large as Vb = 10^. Adding prepara- 
tion noise from Vb = 1 to Vb = 10** reduced the key rate but 
kept the maximum transmission threshold fixed at T = 0.5. 

We now consider what happens to the secret key rate 
j^^lHom] j.jjg asymptotic limit where the preparation noise 
goes to infinity Vb oo and the channel noise is much 



smaller, i.e., W <C Vb. To do this we consider the fixed ratio 

(52) 



Vs 

:=-^>0. 



In our calculations we make the substitution Vs = (f)Vo and 
take the limit Vb — > oo. We begin by first considering the mu- 
tual information between Alice and Bob as defined in Eq. ( [TT] ). 
Following the recipe given above we obtain 



I{Xa : Xb) 



1 



log2(l + ^ 



(53) 



The above equation is simply Shannon's formula for the clas- 
sical capacity of a single-mode communication channel with 
additive Gaussian noise of variance Vb and input Gaussian 
signal Vs ll2Tll . We now calculate the mutual information 
between Eve and Alice I{Xa : E) in this so-called clas- 
sical limit. To do this we follow the techniques given in 
Sec. IV A. Note that Eve and Alice's mutual information is 
defined in Eq. ( |46] | and uses Eq. ( fTTT i with Eq. ( fT2] ). However, 
in this asymptotic limit the symplectic eigenvalues are also 
very large, i.e., S> 1, in which case Eq. ( fT2] i is simplified to 



.gH = log2 (y) 



(54) 



Again in this asymptotic limit, the first symplectic spectrum 
value of Eve using Eq. dZSl ) is given by 



= (1 - T)V. 



(55) 



While the other symplectic eigenvalue can be calculated in the 
same manner to give 



W. 



(56) 



To calculate the conditional symplectic spectrum i^e\Xa 
use Eq. (|32] ) where 



A =W^ + {¥ -TV + TW)(yo - TVo + TW) 
- 2T{W^ ~ 1), 



(57) 



and 



(A2 - 4detV£|xJ - (T - \f{T'^{V - Wf{V^ - Wf 

+ (W^ - VVof- + 2T(y - T4^)(T4^ - Vb)(T4^^ + VVq - 2)]. 

(58) 

Taking the limit as before gives, for the first symplectic eigen- 
value, the following 



E\Xa 



v/rT0(i - T)v^ + o(V')- 



(59) 



Now in order to get a non-zero value for the other symplectic 
eigenvalue we use Eq. (|33] | to give 



[\-T)-\ 



' (T + VW - TVW)<(F + VbTV^ - rVbT^) 



Wo 



(60) 
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Using the above asymptotic formulas with Eq. ( l45T l, we find 
that a positive secret key rate exists only when 



> 0. 



(61) 



The above expression can be simplified to 



l0g2 



[T + VW{1 - T)] [T + VoW{l ~ T)] 



vvoW^{i-Ty 



> 0. (62) 



For a finite information rate we therefore require the following 
inequality to be true 



[T + VW{1 - T)] [T + VaW{l - T)] 
VVoW^{l-T)^ 



> 1. 



(63) 



Algebraically, we find that the above inequality is always sat- 
isfied for our required conditions of 1/2 < T < 1, Vo > 1, 
Vs > I and W > 1. Therefore we have shown that in the 
asymptotic limit where Vq oo, Vs — 0Vb, and W <^ Vq, 
any value of preparation noise can be added onto the initial 
quantum states used by Alice and a secret key can still be 
achieved, albeit with a very small, but still finite, key rate. 
This happens as long as the transmission of the channel is 
greater than a half. 



VI. QUANTUM CRYPTOGRAPHY AT VARIOUS 
ELECTROMAGNETIC WAVELENGTHS 

It is interesting to consider that one possible application 
of the results from the previous two sections is continuous- 
variable QKD over different wavelengths of the electromag- 
netic spectrum. The reason why the previous analyzes would 
be useful for such an application is that the average photon 
number is dependent on the wavelength of the signals sent. 
Typically, QKD experiments |1] are performed at telecom 
wavelengths of 1550 nm where the average photon number 
at room temperature is very low {n ^ 10^ ^''). However, 
when one moves away from this wavelength and down into 
the infrared, the modes become more thermal. In Sec. IV we 
determined that direct reconciliation is significantly more ro- 
bust against preparation noise than reverse reconciliation and 
is therefore better suited to our analysis of QKD at various 
wavelengths. We consider a simply model where Alice sends 
Bob thermal states at a particular wavelength and Bob uses a 
(perfect efficiency) homodyne detector that is unaffected by 
the thermal radiation. Note that if Bob employed heterodyne 
detection the additional unit of shot noise vacuum from the 
heterodyne detector would also be thermal and need to be 
taken into account. For Eve's attack, as with the previous sec- 
tions we assume she performs a collective Gaussian attack, 
but this time with a difference. Eve's ancilla modes, which 
she interacts with Alice's incoming modes (where the inter- 
action is typically modeled using a Gaussian beam splitter), 
are also thermal (for the same reason Alice's are). In order to 
combat this Eve performs her entire attack inside a cryostat, 
see Fig. [8] In preparation for her attack Eve's first step (1) 



is to cool down her thermal ancilla modes so as to approxi- 
mate pure vacuum modes. In the second step (2) she performs 
a collective Gaussian attack via the entangling doner attack. 
Then, before sending the mode Xb' onto Bob, she randomly 
modulates Xb' to create (from Alice and Bob's perspective) 
a thermal state. The variance of this thermal state is chosen 
to be equal to the variance of the environmental noise, so that 
Eve covers her tracks. The key point here is that by modulat- 
ing her modes Eve has effectively added known noise to her 
ancilla modes. 




Eve's cryostat 



FIG. 8: Schematic of a continuous-variable QKD protocol performed 
at different wavelengths of the electromagnetic spectrum. Alice 
sends modes at a particular fixed wavelength to Bob who measures 
the incoming modes using homodyne (Hom) detection. Eve's attack 
consists of using a cryostat which is used to cool down her thermal 
modes to produce pure vacuum modes (1). The second step (2) in- 
volves implementing the entangling doner attack. Finally, Eve adds 
known noise onto the modes Xgi she sends to Bob. This is to cre- 
ate a thermal state in order to match the level of the variance of the 
radiation of the environment, effectively covering her tracks. 



To begin the analysis we need to calculate the variance of a 
mode at a specific wavelength. To do this we note that we can 
write the average photon number n in terms of the quadrature 
variance V as 



1 



V = 2n + l, 



(64) 



where a — [Q ^ iP) /2 and are the annihilation and cre- 
ations operators, respectively, and we have also symmetrized 
both quadratures, i.e., V := V{Q) = V{P). Now the average 
photon number for a single mode is equal to ll29ll 



1 



exp{hf /kBT) ~ 1 ' 



(65) 



where r is the temperature, / is the frequency of the mode, 
h is Planck's constant and /cg is Boltzmann's constant. Us- 
ing the techniques from Sec. IIV Al we can calculate the re- 
gions where continuous-variable QKD is secure as a func- 
tion of the frequency (wavelength) and channel transmission. 
This is plotted in Fig. |9] where areas of security coiTespond to 
R > where again R is the secret key rate. We see that re- 
gions of security exist over various wavelength values from 
optical (1550 nm) into the infrared and down into the mi- 
crowave region. We note that in the original paper 1 1 1], where 
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FIG. 9: Security of continuous-variable QKD as a function of chan- 
nel transmission T at various wavelengths of the electromagnetic 
spectrum at room temperature r = 300 K. Beginning at the infrared 
spectrum (430 THz) and down into the microwave spectrum (starting 
from 300 GHz) where Vs = 10**. The solid (blue) line is the se- 
cure region derived against a collective Gaussian attack. The dotted 
(red) line corresponds to an entanglement-breaking channel where 
Eve performs an intercept-resend attack. In such a situation no se- 
cure key can be synthesized. 



FIG. 10: Security of microwave quantum cryptography. Here we 
consider the upper end of the microwave spectrum, i.e., Vq = 41.66 
(300 GHz) using the direct reconciliation protocol and homodyne 
detection, where W = 41.66 and Vs = 10*. The insecure region 
corresponds to the entanglement-breaking channel where no secure 
key can be created; whilst a region in between the secure and insecure 
region exists where it might be secure but as yet no known protocol 
exists. For example, secure protocols could be developed which are 
based on more complex strategies in terms of classical communica- 
tions and post-processing. 



continuous-variable QKD at various frequencies was first in- 
vestigated, a bound was derived that underestimated the secu- 
rity threshold. The new tigher bound given in Fig. |9]improves 
upon the previous bound by having higher levels of security. 

It is instructive to consider a loss limit (or transmission 
threshold) for QKD at various wavelengths. It is known [3^ 
that a loss limit exists when considering channel noise for 
continuous-variable QKD. This bound corresponds to Eve 
performing an intercept-resend attack which destroys any 
quantum correlations between Alice and Bob and thus the pos- 
sibility of generating a secure key L3 1.1 . In order to avoid an 
entanglement-breaking channel we demand that the equiva- 
lent noise of the quantum channel x cannot exceed one unit 
of shot-noise, i.e., x < 1 L3J- Since x = W{1 - T)/T, the 
security condition becomes 




0.9 0.92 0.94 0.96 
Transmission T 



w < 



T 



1~T 



(66) 



We can rewrite the above equation in terms of a secure bound 
on the required frequency as a function of channel transmis- 
sion. Using the fact that W = 2n + 1 with Eqs. {65[ and i 
we can show that we require 



/>-aln(2T-l), 



(67) 



where a = kBr/h. This curve is plotted as the dotted (red) 
line in Fig.|9]and gives a lower bound in security. 



FIG. 11: How channel noise W affects the security of thermal 
state QKD. Here we have Vb = 41.66 using direct reconcilia- 
tion and homodyne detection with Vs = 10'^. From left to right: 
W — 5, 10, 20, 50, 100. After only modest increases in channel 
noise the security of the protocol reduces rapidly. 



A. Discussion: Feasibility of Microwave QKD 

Here we consider the possibility of using QKD at the mi- 
crowave frequency. The microwave frequency is ubiquitous as 
a communication wavelength in today's technologies, rang- 
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ing from cell phones to short-range devices such as Wi-Fi 
and Bluetooth. The fact that small regions of security ex- 
ist in the microwave regime is initially quite surprising due 
to the presence of large amounts of background noise. We 
consider the microwave frequency from 300 GHz (1 mm) to 
1 GHz (30 cm). Using Eq. i65[ for Alice's initial modes 
we find that this corresponds to a range of variances from 
Vo = 41.66 to Vo = 1.25 x 10'', respectively. In Fig.[TO]we 
plot the case where Vq = 41.66 (i.e., 300 GHz) and where the 
noise on Eve's mode is also W = 41.66. We see that a secure 
key can only be generated when the transmission is higher 
than T « 0.981. Here the straight vertical line distinguishing 
the insecure and secure regions is the entanglement-breaking 
region as given by Eq. dSUl, i.e., T > W/{1 + W) = 0.9766. 
For the 1 GHz frequency, numerically we only start getting 
positive key rates when the channel reflection (i.e., loss) is 
on the order ofl — r~ 10^^ giving a key rate on the or- 
der of i? w lO"*'. Although the secure region is very small, 
the practical required distances are also very small. Such a 
short-range QKD scheme, unlike the typical long-range QKD 
protocols, could potentially be ideal for such devices as Blue- 
tooth (maximum distance of ^ 10 m) and Wi-Fi (^ 75 m). 
Also a secure quantum version of Near Field Communica- 
tion (NFC) t321 would be an ideal application as the range 
with which these microwave devices operate over is ^ 10 cm. 
However, in such a situation what actually constitutes Alice's 
and Bob's stations becomes blurred. We point out that the 
dominate factor in terms of the hmited range in security, is 
the channel noise W and, as we have seen from the results of 
the previous section, not the preparation noise. The effect of 
channel noise on the security of thermal state QKD is plotted 
in Fig.[TT] Here we assume Vq = 41.66 and see that after only 
a small increase in channel noise (i.e., W = 5) one can only 
generate a secure key after T w 0.86. Therefore a continuous- 
variable QKD protocol that is able to tolerate large amounts 
of preparation and channel noise is required, in order to make 
microwave QKD feasible. 

Another possible platform for microwave QKD is using dis- 
crete variables, e.g., the BB84 protocol ll33ll . The preparation 
and detection of photons at the microwave frequency is an 
active field of experimental research in cavity quantum elec- 
trodynamics 134143711 . However, such experiments do not in- 
volve the propagation of microwave photons over free space. 
Although, even if the technology allowed the efficient gen- 
eration and detection of single microwave photons over free 
space, the fundamental problem exists where Bob would not 



be able to distinguish the photons that originated from Alice 
to those which came from the surrounding environment - both 
are indistinguishable. 



VII. CONCLUSION 

In conclusion, we have considered continuous-variable 
quantum key distribution from the perspective of Alice us- 
ing thermal Gaussian states as her initial cryptographic re- 
source, instead of the usual pure Gaussian states. The case 
of direct reconciliation and homodyne detection was first ana- 
lyzed in ifTTIl and we have extended these results here to in- 
clude both direct and reverse reconciliation for the case of 
heterodyne detection. We showed that an improved robust- 
ness to channel noise can be achieved when preparation noise 
is added in the case of direct reconciliation using heterodyne 
detection. In [11] it was shown that direct reconciliation does 
not suffer any loss in security when preparation noise is added 
(although the secret key rate does decrease as a function of 
preparation noise), even when the variance of the initial ther- 
mal states was as large as 10'' times that of the pure vacuum. 
We significantly improved upon this result by showing that 
direct reconciliation can tolerate any amount of preparation 
noise, provided the channel noise is much less than the prepa- 
ration noise. Finally, we derived an upper bound related to an 
entanglement-breaking eavesdropping attack for quantum key 
distribution at various electromagnetic wavelengths and ended 
with a discussion on the feasibility of microwave quantum key 
distribution. 
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